Researchers Report Cairn-Assisted Attacks on 100 E-Commerce Sites
Summary
NorForge says attackers used exposed Cairn dashboards to coordinate automated attacks against 100 sites. At least one attack installed a web shell; the extent of damage remains unclear, and named organizations reported remediation or ongoing investigation.
Key points
- NorForge found more than 20 publicly exposed Cairn control panels and identified over 1,100 attack projects across 14 dashboards it associated with the activity.
- The campaign targeted 100 sites across multiple regions, focusing on e-commerce and payment infrastructure. Reuters identified John Deere, SharkNinja and Cummins among the organizations targeted.
- NorForge assessed two of three activity clusters as malicious and found evidence of automated workflows seeking vulnerabilities and persistent access.
- Agents were tasked with finding weaknesses including SQL injection, unsafe file uploads, insecure deserialization, authentication bypasses and server-side template injection; some instructions directed them to deploy web shells.
- NorForge confirmed at least one web-shell installation on a commercial website and observed separate operations targeting credit-card data and cryptocurrency. Overall damage remains unclear.
- John Deere said it took remedial action and had no indication sensitive information was accessed; SharkNinja said the incident was contained and affected a standalone product-support site. Cummins was investigating a potential attack on a third-party vendor website.
- NorForge was notifying victims and seeking takedowns of the Cairn panels. Experts advised organizations to inventory internet-facing assets, test them continuously, prioritize exposed credentials and keys, and close gaps between finding and fixing vulnerabilities.
Article Details
- Event Type
- Reported financially motivated cyberattack campaign using the AI-driven penetration-testing tool Cairn to automate attacks against e-commerce websites.
- Impact
- NorForge reported attacks targeting 100 sites and more than 1,100 attack projects across 14 dashboards. It confirmed at least one Web shell installation on a commercial website and observed separate operations targeting credit-card data and cryptocurrency. The overall damage remains unclear; named victims reported remedial action, containment, or an ongoing investigation.
MITRE ATT&CK
T1190 · Exploit Public-Facing ApplicationAttackers used Cairn agents to find and exploit weaknesses, including SQL injection, in victim websites.T1505.003 · Web ShellNorForge confirmed at least one Web shell installation on a commercial website; some agent instructions reportedly directed deployment of Web shells for ongoing access.
People
Rickard CarlssonCEO of Detectify who commented on the cost and scale of AI-assisted attacks.Snorre FagerlandNorForge founding researcher who reported on the attack projects, exposed secrets, and victim-site activity.Tyler OliverCEO and founder of Huntbase who commented on the attackers' use of AI agents.
Tools
Countries
AustraliaThe attackers targeted 100 sites across various global regions, including the US, Australia, Canada, and Japan, with a focus on e-commerce and payment infrastructure, according to a report published over the weekend byCanadaThe attackers targeted 100 sites across various global regions, including the US, Australia, Canada, and Japan, with a focus on e-commerce and payment infrastructure, according to a report published over the weekend byJapanThe attackers targeted 100 sites across various global regions, including the US, Australia, Canada, and Japan, with a focus on e-commerce and payment infrastructure, according to a report published over the weekend byUnited StatesThe attackers targeted 100 sites across various global regions, including the US, Australia, Canada, and Japan, with a focus on e-commerce and payment infrastructure, according to a report published over the weekend by
Industries
E-commerceChinese-speaking hackers have largely outsourced a maelstrom of malicious activity against numerous e-commerce websites to the AI-driven penetration testing tool Cairn, with researchers finding more than 20 publiclypayment infrastructureglobal regions, including the US, Australia, Canada, and Japan, with a focus on e-commerce and payment infrastructure, according to a report published over the weekend by the security firm NorForge.